45 CFR 160.103 HIPAA · Part 160: GENERAL ADMINISTRATIVE REQUIREMENTS · Subpart A: General Provisions
45 CFR 160.103 HIPAA: Definitions
eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026.
Official text
Except as otherwise provided, the following definitions apply to this subchapter:
Act means the Social Security Act.
Administrative simplification provision means any requirement or prohibition established by:
42 U.S.C. 1320d-1320d-4, 1320d-7, 1320d-8, and 1320d-9;
Section 264 of Pub. L. 104-191;
Sections 13400-13424 of Public Law 111-5; or
This subchapter.
ALJ means Administrative Law Judge.
ANSI stands for the American National Standards Institute.
Business associate: (1) Except as provided in paragraph (4) of this definition, business associate means, with respect to a covered entity, a person who:
On behalf of such covered entity or of an organized health care arrangement (as defined in this section) in which the covered entity participates, but other than in the capacity of a member of the workforce of such covered entity or arrangement, creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, patient safety activities listed at 42 CFR 3.20, billing, benefit management, practice management, and repricing; or
Provides, other than in the capacity of a member of the workforce of such covered entity, legal, actuarial, accounting, consulting, data aggregation (as defined in § 164.501 of this subchapter), management, administrative, accreditation, or financial services to or for such covered entity, or to or for an organized health care arrangement in which the covered entity participates, where the provision of the service involves the disclosure of protected health information from such covered entity or arrangement, or from another business associate of such covered entity or arrangement, to the person.
A covered entity may be a business associate of another covered entity.
Business associate includes:
A Health Information Organization, E-prescribing Gateway, or other person that provides data transmission services with respect to protected health information to a covered entity and that requires access on a routine basis to such protected health information.
A person that offers a personal health record to one or more individuals on behalf of a covered entity.
A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate.
Business associate does not include:
A health care provider, with respect to disclosures by a covered entity to the health care provider concerning the treatment of the individual.
A plan sponsor, with respect to disclosures by a group health plan (or by a health insurance issuer or HMO with respect to a group health plan) to the plan sponsor, to the extent that the requirements of § 164.504(f) of this subchapter apply and are met.
A government agency, with respect to determining eligibility for, or enrollment in, a government health plan that provides public benefits and is administered by another government agency, or collecting protected health information for such purposes, to the extent such activities are authorized by law.
A covered entity participating in an organized health care arrangement that performs a function or activity as described by paragraph (1)(i) of this definition for or on behalf of such organized health care arrangement, or that provides a service as described in paragraph (1)(ii) of this definition to or for such organized health care arrangement by virtue of such activities or services.
Civil money penalty or penalty means the amount determined under § 160.404 of this part and includes the plural of these terms.
CMS stands for Centers for Medicare & Medicaid Services within the Department of Health and Human Services.
Compliance date means the date by which a covered entity or business associate must comply with a standard, implementation specification, requirement, or modification adopted under this subchapter.
Covered entity means:
A health plan.
A health care clearinghouse.
A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.
Disclosure means the release, transfer, provision of access to, or divulging in any manner of information outside the entity holding the information.
EIN stands for the employer identification number assigned by the Internal Revenue Service, U.S. Department of the Treasury. The EIN is the taxpayer identifying number of an individual or other entity (whether or not an employer) assigned under one of the following:
26 U.S.C. 6011(b), which is the portion of the Internal Revenue Code dealing with identifying the taxpayer in tax returns and statements, or corresponding provisions of prior law.
26 U.S.C. 6109, which is the portion of the Internal Revenue Code dealing with identifying numbers in tax returns, statements, and other required documents.
Electronic media means:
Electronic storage material on which data is or may be recorded electronically, including, for example, devices in computers (hard drives) and any removable/transportable digital memory medium, such as magnetic tape or disk, optical disk, or digital memory card;
Transmission media used to exchange information already in electronic storage media. Transmission media include, for example, the Internet, extranet or intranet, leased lines, dial-up lines, private networks, and the physical movement of removable/transportable electronic storage media. Certain transmissions, including of paper, via facsimile, and of voice, via telephone, are not considered to be transmissions via electronic media if the information being exchanged did not exist in electronic form immediately before the transmission.
Electronic protected health information means information that comes within paragraphs (1)(i) or (1)(ii) of the definition of protected health information as specified in this section.
Employer is defined as it is in 26 U.S.C. 3401(d).
Family member means, with respect to an individual:
A dependent (as such term is defined in 45 CFR 144.103), of the individual; or
Any other person who is a first-degree, second-degree, third-degree, or fourth-degree relative of the individual or of a dependent of the individual. Relatives by affinity (such as by marriage or adoption) are treated the same as relatives by consanguinity (that is, relatives who share a common biological ancestor). In determining the degree of the relationship, relatives by less than full consanguinity (such as half-siblings, who share only one parent) are treated the same as relatives by full consanguinity (such as siblings who share both parents).
First-degree relatives include parents, spouses, siblings, and children.
Second-degree relatives include grandparents, grandchildren, aunts, uncles, nephews, and nieces.
Third-degree relatives include great-grandparents, great-grandchildren, great aunts, great uncles, and first cousins.
Fourth-degree relatives include great-great grandparents, great-great grandchildren, and children of first cousins.
Genetic information means:
Subject to paragraphs (2) and (3) of this definition, with respect to an individual, information about:
The individual's genetic tests;
The genetic tests of family members of the individual;
The manifestation of a disease or disorder in family members of such individual; or
Any request for, or receipt of, genetic services, or participation in clinical research which includes genetic services, by the individual or any family member of the individual.
Any reference in this subchapter to genetic information concerning an individual or family member of an individual shall include the genetic information of:
A fetus carried by the individual or family member who is a pregnant woman; and
Any embryo legally held by an individual or family member utilizing an assisted reproductive technology.
Genetic information excludes information about the sex or age of any individual.
Genetic services means:
A genetic test;
Genetic counseling (including obtaining, interpreting, or assessing genetic information); or
Genetic education.
Genetic test means an analysis of human DNA, RNA, chromosomes, proteins, or metabolites, if the analysis detects genotypes, mutations, or chromosomal changes. Genetic test does not include an analysis of proteins or metabolites that is directly related to a manifested disease, disorder, or pathological condition.
Group health plan (also see definition of health plan in this section) means an employee welfare benefit plan (as defined in section 3(1) of the Employee Retirement Income and Security Act of 1974 (ERISA), 29 U.S.C. 1002(1)), including insured and self-insured plans, to the extent that the plan provides medical care (as defined in section 2791(a)(2) of the Public Health Service Act (PHS Act), 42 U.S.C. 300gg-91(a)(2)), including items and services paid for as medical care, to employees or their dependents directly or through insurance, reimbursement, or otherwise, that:
Has 50 or more participants (as defined in section 3(7) of ERISA, 29 U.S.C. 1002(7)); or
Is administered by an entity other than the employer that established and maintains the plan.
HHS stands for the Department of Health and Human Services.
Health care means care, services, or supplies related to the health of an individual. Health care includes, but is not limited to, the following:
Preventive, diagnostic, therapeutic, rehabilitative, maintenance, or palliative care, and counseling, service, assessment, or procedure with respect to the physical or mental condition, or functional status, of an individual or that affects the structure or function of the body; and
Sale or dispensing of a drug, device, equipment, or other item in accordance with a prescription.
Health care clearinghouse means a public or private entity, including a billing service, repricing company, community health management information system or community health information system, and “value-added” networks and switches, that does either of the following functions:
Processes or facilitates the processing of health information received from another entity in a nonstandard format or containing nonstandard data content into standard data elements or a standard transaction.
Receives a standard transaction from another entity and processes or facilitates the processing of health information into nonstandard format or nonstandard data content for the receiving entity.
Health care provider means a provider of services (as defined in section 1861(u) of the Act, 42 U.S.C. 1395x(u)), a provider of medical or health services (as defined in section 1861(s) of the Act, 42 U.S.C. 1395x(s)), and any other person or organization who furnishes, bills, or is paid for health care in the normal course of business.
Health information means any information, including genetic information, whether oral or recorded in any form or medium, that:
Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and
Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.
Health insurance issuer (as defined in section 2791(b)(2) of the PHS Act, 42 U.S.C. 300gg-91(b)(2) and used in the definition of health plan in this section) means an insurance company, insurance service, or insurance organization (including an HMO) that is licensed to engage in the business of insurance in a State and is subject to State law that regulates insurance. Such term does not include a group health plan.
Health maintenance organization (HMO) (as defined in section 2791(b)(3) of the PHS Act, 42 U.S.C. 300gg-91(b)(3) and used in the definition of health plan in this section) means a federally qualified HMO, an organization recognized as an HMO under State law, or a similar organization regulated for solvency under State law in the same manner and to the same extent as such an HMO.
Health plan means an individual or group plan that provides, or pays the cost of, medical care (as defined in section 2791(a)(2) of the PHS Act, 42 U.S.C. 300gg-91(a)(2)).
Health plan includes the following, singly or in combination:
A group health plan, as defined in this section.
A health insurance issuer, as defined in this section.
An HMO, as defined in this section.
Part A or Part B of the Medicare program under title XVIII of the Act.
The Medicaid program under title XIX of the Act, 42 U.S.C. 1396, et seq.
The Voluntary Prescription Drug Benefit Program under Part D of title XVIII of the Act, 42 U.S.C. 1395w-101 through 1395w-152.
An issuer of a Medicare supplemental policy (as defined in section 1882(g)(1) of the Act, 42 U.S.C. 1395ss(g)(1)).
An issuer of a long-term care policy, excluding a nursing home fixed indemnity policy.
An employee welfare benefit plan or any other arrangement that is established or maintained for the purpose of offering or providing health benefits to the employees of two or more employers.
The health care program for uniformed services under title 10 of the United States Code.
The veterans health care program under 38 U.S.C. chapter 17.
The Indian Health Service program under the Indian Health Care Improvement Act, 25 U.S.C. 1601, et seq.
The Federal Employees Health Benefits Program under 5 U.S.C. 8902, et seq.
An approved State child health plan under title XXI of the Act, providing benefits for child health assistance that meet the requirements of section 2103 of the Act, 42 U.S.C. 1397, et seq.
The Medicare Advantage program under Part C of title XVIII of the Act, 42 U.S.C. 1395w-21 through 1395w-28.
A high risk pool that is a mechanism established under State law to provide health insurance coverage or comparable coverage to eligible individuals.
Any other individual or group plan, or combination of individual or group plans, that provides or pays for the cost of medical care (as defined in section 2791(a)(2) of the PHS Act, 42 U.S.C. 300gg-91(a)(2)).
Health plan excludes:
Any policy, plan, or program to the extent that it provides, or pays for the cost of, excepted benefits that are listed in section 2791(c)(1) of the PHS Act, 42 U.S.C. 300gg-91(c)(1); and
A government-funded program (other than one listed in paragraph (1)(i)-(xvi) of this definition):
Whose principal purpose is other than providing, or paying the cost of, health care; or
Whose principal activity is:
The direct provision of health care to persons; or
The making of grants to fund the direct provision of health care to persons.
Implementation specification means specific requirements or instructions for implementing a standard.
Individual means the person who is the subject of protected health information.
Individually identifiable health information is information that is a subset of health information, including demographic information collected from an individual, and:
Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and
Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and
That identifies the individual; or
With respect to which there is a reasonable basis to believe the information can be used to identify the individual.
Manifestation or manifested means, with respect to a disease, disorder, or pathological condition, that an individual has been or could reasonably be diagnosed with the disease, disorder, or pathological condition by a health care professional with appropriate training and expertise in the field of medicine involved. For purposes of this subchapter, a disease, disorder, or pathological condition is not manifested if the diagnosis is based principally on genetic information.
Modify or modification refers to a change adopted by the Secretary, through regulation, to a standard or an implementation specification.
Organized health care arrangement means:
A clinically integrated care setting in which individuals typically receive health care from more than one health care provider;
An organized system of health care in which more than one covered entity participates and in which the participating covered entities:
Hold themselves out to the public as participating in a joint arrangement; and
Participate in joint activities that include at least one of the following:
Utilization review, in which health care decisions by participating covered entities are reviewed by other participating covered entities or by a third party on their behalf;
Quality assessment and improvement activities, in which treatment provided by participating covered entities is assessed by other participating covered entities or by a third party on their behalf; or
Payment activities, if the financial risk for delivering health care is shared, in part or in whole, by participating covered entities through the joint arrangement and if protected health information created or received by a covered entity is reviewed by other participating covered entities or by a third party on their behalf for the purpose of administering the sharing of financial risk.
A group health plan and a health insurance issuer or HMO with respect to such group health plan, but only with respect to protected health information created or received by such health insurance issuer or HMO that relates to individuals who are or who have been participants or beneficiaries in such group health plan;
A group health plan and one or more other group health plans each of which are maintained by the same plan sponsor; or
The group health plans described in paragraph (4) of this definition and health insurance issuers or HMOs with respect to such group health plans, but only with respect to protected health information created or received by such health insurance issuers or HMOs that relates to individuals who are or have been participants or beneficiaries in any of such group health plans.
Person means a natural person (meaning a human being who is born alive), trust or estate, partnership, corporation, professional association or corporation, or other entity, public or private.
Protected health information means individually identifiable health information:
Except as provided in paragraph (2) of this definition, that is:
Transmitted by electronic media;
Maintained in electronic media; or
Transmitted or maintained in any other form or medium.
Protected health information excludes individually identifiable health information:
In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g;
In records described at 20 U.S.C. 1232g(a)(4)(B)(iv);
In employment records held by a covered entity in its role as employer; and
Regarding a person who has been deceased for more than 50 years.
Public health, as used in the terms “public health surveillance,” “public health investigation,” and “public health intervention,” means population-level activities to prevent disease in and promote the health of populations. Such activities include identifying, monitoring, preventing, or mitigating ongoing or prospective threats to the health or safety of a population, which may involve the collection of protected health information. But such activities do not include those with any of the following purposes:
To conduct a criminal, civil, or administrative investigation into any person for the mere act of seeking, obtaining, providing, or facilitating health care.
To impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating health care.
To identify any person for any of the activities described at paragraphs (1) or (2) of this definition.
Reproductive health care means health care, as defined in this section, that affects the health of an individual in all matters relating to the reproductive system and to its functions and processes. This definition shall not be construed to set forth a standard of care for or regulate what constitutes clinically appropriate reproductive health care.
Respondent means a covered entity or business associate upon which the Secretary has imposed, or proposes to impose, a civil money penalty.
Small health plan means a health plan with annual receipts of $5 million or less.
Standard means a rule, condition, or requirement:
Describing the following information for products, systems, services, or practices:
Classification of components;
Specification of materials, performance, or operations; or
Delineation of procedures; or
With respect to the privacy of protected health information.
Standard setting organization (SSO) means an organization accredited by the American National Standards Institute that develops and maintains standards for information transactions or data elements, or any other standard that is necessary for, or will facilitate the implementation of, this part.
State refers to one of the following:
For a health plan established or regulated by Federal law, State has the meaning set forth in the applicable section of the United States Code for such health plan.
For all other purposes, State means any of the several States, the District of Columbia, the Commonwealth of Puerto Rico, the Virgin Islands, Guam, American Samoa, and the Commonwealth of the Northern Mariana Islands.
Subcontractor means a person to whom a business associate delegates a function, activity, or service, other than in the capacity of a member of the workforce of such business associate.
Trading partner agreement means an agreement related to the exchange of information in electronic transactions, whether the agreement is distinct or part of a larger agreement, between each party to the agreement. (For example, a trading partner agreement may specify, among other things, the duties and responsibilities of each party to the agreement in conducting a standard transaction.)
Transaction means the transmission of information between two parties to carry out financial or administrative activities related to health care. It includes the following types of information transmissions:
Health care claims or equivalent encounter information.
Health care payment and remittance advice.
Coordination of benefits.
Health care claim status.
Enrollment and disenrollment in a health plan.
Eligibility for a health plan.
Health plan premium payments.
Referral certification and authorization.
First report of injury.
Health care claims attachments.
Health care electronic funds transfers (EFT) and remittance advice.
Other transactions that the Secretary may prescribe by regulation.
Use means, with respect to individually identifiable health information, the sharing, employment, application, utilization, examination, or analysis of such information within an entity that maintains such information.
Violation or violate means, as the context may require, failure to comply with an administrative simplification provision.
Workforce means employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a covered entity or business associate, is under the direct control of such covered entity or business associate, whether or not they are paid by the covered entity or business associate.
Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR.
Source credit: [65 FR 82798, Dec. 28, 2000, as amended at 67 FR 38019, May 31, 2002; 67 FR 53266, Aug. 14, 2002; 68 FR 8374, Feb. 20, 2003; 71 FR 8424, Feb. 16, 2006; 76 FR 40495, July 8, 2011; 77 FR 1589, Jan. 10, 2012; 78 FR 5687, Jan. 25, 2013; 89 FR 33062, Apr. 26, 2024; 91 FR 14404, Mar. 24, 2026]
eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026.
This is reference material, not legal advice.